About one year ago, for about two months, lots of user accounts with unverified login email address started to pile-up.
All addresses belonged to @yahoo.com. It appears (don't know for sure) some sort of Yahoo! Messenger vulnerability allowed some hackers to spread to many systems and then create accounts on our website.
Some users clicked on the activation link, although the email was correctly informing not to take any action if they did not request an account.
The only thing that could be deduced as usefull for the attackers, was that they knew the passwords for the new accounts, and were hoping to create as many accounts as possible (from different IP addresses) with an automatic effort from different locations, while avoiding captchas or other rate limiting protections.
This same type of attack can be used to impersonate someone with elevated access to some services (me thinks).
The only protection I can think of is asking the user to choose a password after clicking the account activation link, which will also perform auto-login. To create an account, the user will only be asked for his email address. I haven't seen this done anywhere else at all, is there a security drawback I am missing?